(L1) Ensure Information Protection sensitivity label policies are published
CIS.M365.3.3.1LowPurviewInformation protectionPreview 3.0
Part of CIS · Purview · Information protection · All checks
Invoke-Maester -TestId CIS.M365.3.3.1Overview
Section titled “Overview”At least one sensitivity label policy is published, so users can apply sensitivity labels to their files and email.
Sensitivity labels classify content and can add encryption, markings and access restrictions that stay with a file when it leaves your tenant. A label that is not published to users cannot be applied, so a tenant without a published policy has no consistent way to say which content is confidential.
Creating the labels is only the first step. A label policy makes them available to the users and groups that you choose, and can set a default label and require users to label content.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Purview portal.
- Go to Solutions > Information Protection > Sensitivity labels and create the labels you need.
- Open the Label policies tab and select Publish label.
- Choose the labels, the users and groups to publish to, and the policy settings, such as a default label and mandatory labelling.
- Finish the wizard.
Related links
Section titled “Related links”- Microsoft Purview portal - Label policies
- Create and publish sensitivity labels
- Learn about sensitivity labels
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 3.3.1
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.3.3.1 |
| Severity | Low |
| Suite | CIS |
| Product | Purview |
| Feature | Information protection |
| Area | Data protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 3.3.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:3.3.1, nist-800-53-r5:AC-4 |
| PowerShell test | Test-MtCisSensitivityLabelPoliciesPublished |
| Services | SecurityCompliance |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.3.3.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.3.3.1.md